Hardware Hacking — The Complete Chip-Off & Chip-On Masterclass - Captain - DCTSG2027
Description
Name of Training: Hardware Hacking — The Complete Chip-Off & Chip-On Masterclass
Trainer(s): Captain
Skill Level: Intermediate
Dates: March 7, 2027
Time: 9 to 5 pm
Venue: TBD
Early Bird Cost: S$2,200 (incl. GST, until Dec 31, 2026)
Regular Cost: S$2,500 (incl. GST)
Short Summary
This intensive hands-on lab teaches students how to bypass locked debug interfaces by physically extracting raw flash memory through BGA desoldering, reballing, and 0.1 mm ISP wire-jumping using accessible tooling. Attendees master the complete hardware lifecycle—from acquiring bit-stream forensic images in Linux to resoldering the chip ("Chip-On") to restore full target device functionality.
Course Description
Modern embedded systems, IoT hardware, and mobile platforms increasingly disable JTAG, lock UART consoles, and restrict external debug interfaces. When logical vectors are exhausted, physical memory extraction becomes the definitive attack surface.This intensive 1-day, fast-paced masterclass teaches attendees how to bypass hardware defenses through low-level non-volatile memory extraction. Attendees progress from raw physical teardowns to forensic acquisition and device restoration. The course covers the complete lifecycle: identifying pinouts and logic levels ($V_{CC}$ vs. $V_{CCQ}$), safely lifting delicate BGA eMMC/Flash packages from host boards, removing abrasive underfill, reballing chips with steel stencils, dumping raw bit-streams using Linux-native card reader controllers, performing non-destructive In-System Programming (ISP) micro-soldering, and finally resoldering the chip back onto the host board ("Chip-On") to restore full device functionality.
Course Outline
View full outline
Hide outline
Day 1 - Morning
09:00 - 10:15 | Module 1: Architecture, Pinouts & Logic Levels
10:15 - 10:30 | Morning Break
10:30 - 12:30 | Module 2: Safe BGA Desoldering & Underfill Removal
Day 1 - Afternoon
13:30 - 14:45 | Module 3: Pad Dressing & Precision BGA Reballing
14:45 - 16:00 | Module 4: Socket-Based Acquisition & Linux Kernel Forensics
16:00 - 16:15 | Afternoon Break
16:15 - 17:15 | Module 5: Non-Destructive In-System Programming (ISP) Wire-Jumping
17:15 - 18:00 | Module 6: Chip-On Restoration & Image Triage
Difficulty Level
Intermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.
Suggested Prerequisites
- Basic familiarity with the Linux command line (dd, mount, package managers).
- Foundational understanding of digital electronics (voltage, ground, data buses).
- Previous soldering experience is helpful, but micro-soldering techniques will be taught from the ground up.
What Students Should Bring
- Laptop with at least 8 GB RAM and 40 GB free storage space.
- VirtualBox 7.x installed with the VirtualBox Extension Pack (or a native Linux dual-boot).
- At least two functional USB-A ports (or reliable USB-C to USB-A adapters).
- Pre-configured Kali Linux or Ubuntu/Linux Mint 64-bit Virtual Machine.
What the Trainer Will Provide
Readers & Adapters: 1× RTS5170 BGA153/169 clamshell socket reader board. 1× eMMC-to-SD carrier test breakout boards. Silicon & Test Media: 1× Brand-new, unprogrammed 4 GB/16 GB BGA153 eMMC chip. 1× IoT target motherboard with factory underfilled eMMC. Consumables: 1× Universal eMMC BGA steel reballing stencil (BGA153/169/221). 1× BGA flux syringe, desoldering copper braid, and precision tweezers. 1x Hot Air gun
Trainer(s) Bio
Captain is a hardware security researcher and technical trainer specializing in physical-layer penetration testing, low-level non-volatile memory extraction, and hardware forensics. His hands-on research centers on embedded security bypasses, micro-soldering, BGA rework, and non-destructive In-System Programming (ISP) across IoT, mobile, and automotive platforms. Dedicated to tackling hardware targets where logical access vectors like JTAG and UART consoles are locked or absent, he focuses on practical, low-cost toolchains and open-source Linux workflows that bypass proprietary commercial boxes.
An active mentor and community educator, he regularly develops and delivers technical training workshops designed to lower the barrier of entry to physical hardware exploitation. His teaching emphasizes practical, bench-level problem-solving—guiding security engineers, digital forensics investigators, and penetration testers through the complete hardware exploitation lifecycle from initial teardown and microscopic flying-wire jumping to forensic extraction and live board restoration ("Chip-On").
Proficiency Exam
Students will demonstrate proficiency through continuous, instructor-verified practical milestones embedded directly into the hands-on laboratory exercises. Assessment is evaluated against three core physical and technical benchmarks: executing a clean BGA desoldering and reballing cycle without pad damage, soldering a functional 1-bit ISP flying-wire interface without line shorts, and successfully mounting and extracting an error-free bit-stream raw image via Linux. To successfully earn the certificate of proficiency, students must complete at least 80% of these assessed hands-on milestones, culminating in a verified raw partition dump and a short-free continuity check on the restored board.
Registration Terms and Conditions
Trainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.
Between January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.
All trainings are non-refundable after Feb 28, 2027.
Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.
If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).
Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.
DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.
By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.
Several breaks will be included throughout the day. Please note that food is not included.
All courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.
